{"record":{"id":"e12612941f55ca0f","repo":"kubernetes/kops","slug":"listing-ssh-credentials-v","errorCode":null,"errorMessage":"listing SSH credentials %v","messagePattern":"listing SSH credentials (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/kops/get_sshpublickeys.go","lineNumber":92,"sourceCode":"\tif err != nil {\n\t\treturn err\n\t}\n\n\tcluster, err := clientset.GetCluster(ctx, options.ClusterName)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tsshCredentialStore, err := clientset.SSHCredentialStore(cluster)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tvar items []*SSHKeyItem\n\n\tl, err := sshCredentialStore.FindSSHPublicKeys()\n\tif err != nil {\n\t\treturn fmt.Errorf(\"listing SSH credentials %v\", err)\n\t}\n\n\tfor _, key := range l {\n\t\tid, err := sshcredentials.Fingerprint(key.Spec.PublicKey)\n\t\tif err != nil {\n\t\t\tklog.Warningf(\"unable to compute fingerprint for public key\")\n\t\t}\n\t\titem := &SSHKeyItem{\n\t\t\tID:        id,\n\t\t\tPublicKey: key.Spec.PublicKey,\n\t\t}\n\n\t\titems = append(items, item)\n\t}\n\n\tswitch options.Output {\n\n\tcase OutputTable:","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/cmd/kops/get_sshpublickeys.go#L74-L110","documentation":"RunGetSSHPublicKeys lists public keys via sshCredentialStore.FindSSHPublicKeys(). If the underlying store (typically the cluster's keyStore backed by the state store) fails to enumerate keys, the error is wrapped as \"listing SSH credentials %v\". This is a read failure on the credentials store, not a per-key problem.","triggerScenarios":"`kops get sshpublickeys` when the state store is unreachable (bad --state flag, missing cloud credentials), the sshpublickey object storage is corrupted, or a network error occurs while reading the store.","commonSituations":"Wrong or missing --state s3 bucket; expired AWS credentials; offline runs against a remote state store; permission denied on the state store object.","solutions":["Read the wrapped error after 'listing SSH credentials' — it names the real cause","Verify --state points at the correct store and credentials are valid (e.g. aws s3 ls <bucket>)","Check network connectivity/permissions to the state store backend","Retry if the failure was transient (timeout, throttling)"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"# verify state store reachability first\naws s3 ls \"$(kops get clusters --state \"$STATE\" -o json | jq -r '.[0].configBase')\" >/dev/null || { echo 'state store unreachable'; exit 1; }","typeGuard":null,"tryCatchPattern":"if err := runGetSSHPublicKeys(opts); err != nil {\n\tif isTransient(err) { // timeout/throttle per wrapped error\n\t\ttime.Sleep(backoff); retry()\n\t}\n\treturn err\n}","preventionTips":["Confirm --state and cloud credentials before running get commands","Test state store connectivity (aws s3 ls) in CI before kops calls","Distinguish transient (timeout) from permanent (permission) wrapped errors"],"tags":["cli","state-store","ssh"],"backgroundTag":"state-store-unreachable","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T07:17:12.445Z"}